The correct answer is A, Lateral movement. Lateral movement occurs after initial compromise, when an attacker moves from one system to other internal hosts, accounts, or resources. This phase is especially difficult to detect without centralized logging because evidence is scattered across many endpoints, servers, authentication systems, and network devices. CEH incident response and SOC concepts emphasize SIEM functions such as identifying, monitoring, recording, auditing, and analyzing security incidents, which depend heavily on centralized log collection and correlation. CEH foundation material also notes that when audit
/event logs are not properly configured or maintained, incident investigation becomes extremely difficult. In hacking methodology, expanding control from one host to other hosts in the network is described as takeover, which maps closely to lateral movement. Recon, delivery, and initial access may be visible at perimeter or endpoint controls, but lateral movement requires cross-system correlation, making it the hardest phase to detect without centralized logs.